Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.

On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

Step 5

Delete this registry key

[ Learn More ]

[ back ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software

Local AppWizard-Generated Applications

To delete registry keys this malware/grayware created:

Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.

In the left panel of the Registry Editor window, double-click the following: HKEY_CURRENT_USER>Software

Still in the left panel, locate and delete the key:Local AppWizard-Generated Applications

Close Registry Editor.

Step 6

Delete this registry value

[ Learn More ]

[ back ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run

tpbar = "%System%S\tpframe.exe"

To delete the registry value this malware created:

Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.

In the left panel of the Registry Editor window, double-click the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Explorer>run

In the right panel, locate and delete the entry:tpbar = "%System%S\tpframe.exe"

Close Registry Editor.

Step 7

Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_SASFIS.EVL. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.